GPO not applying to an OU

Question

We have a batch file (logon.bat) that maps drives whenever a user logs on.

This script is applied by Group Policy to the entire domain.

Initially, this worked perfectly, as we always wanted this script to be applied. However, now we have PCs at a remote site accessing the domain via a VPN link. These PCs can take as long as 5 minutes to log on due to the combination of the drive mapping script and the slow VPN link. I experimented by removing "logon.bat" from the "Default Domain Policy" GPO, and users at the remote site could log on a few minutes faster. This is perfect- I can manually map drives at the remote site for the small number of users who need network access there.

What I then tried to do, was to create two OUs: "Main office" (where we want to continue to use the drive mapping script), and "Off-site" (for the remote site, and also laptops which are domain-joined).

The only problem is that, when I remove the reference to "logon.bat" from the "Default Domain Policy" GPO, and add it to the "Map drives at logon" GPO applied to "Main office", it no longer gets applied to the main office. I can't selectively apply drive mapping only to users at the main site.

We can't keep using an all-or-nothing approach to this logon script any more because of the performance impact it has to users working remotely.

Does anyone have any idea why the drive mapping stops working when I try to get a different GPO to handle it?

Solution 1

As mentioned, you have user policy settings being set to computer accounts. By default, this won't work.

You can get it working this way by enabling Loopback mode processing on the policy you are creating to process the settings for users logging into those computers. Loopback Processing will allow the user policy settings to be applied on a policy applied to a computer account.

Please note that enabling loopback mode will enable it on all policies in that OU applied after the policy enabling loopback mode.

Solution 2

You have a user policy being bound to a computer OU. The settings need to match up to the contents of the OU they are bound to.

Solution 3

A logon script is a user policy. It won't apply to computers that you put in that OU, because it applies to users.

Solution 4

As other answers have stated, user policies don't apply to computers, but you can use loopback processing mode to allow this.

How much bandwidth do you have between the sites, and how many users/computers are at the remote site?

I suspect the delays you are seeing aren't due to the policies you are applying, but actually because you are mapping network drives over a slow WAN link.

---

I can't tell from the detail in your question, but if you haven't already, you'd see a big improvement if you installed a domain controller at your remote site, configured an AD site & subnet, and set up DFSR to replicate your network shares between the two sites.

We've been running a similar set up since around 2006, replicating around 500GB of data between two file servers with a bandwidth of no more than a theoretical maximum of 384Kbps. Depending on how much data/bandwidth you have, I'd recommend kicking off the initial replication with the remote site server located at the main office, otherwise you could be waiting a long time for the initial sync to complete.

View more solutions

Comments

[Austin ''Danger'' Powers]

Thanks. I'm a little surprised that user settings are only applied if you assign a GPO to a user (and likewise computer settings for a GPO assigned to computer). I had assumed that both user and computer settings would be applied to whatever user or computer the GPO was assigned to. Looks like I was completely wrong about that. So doing what I was planning (applying a user policy only to certain computers) won't be as straightforward as I thought.

[Rex]

It is still fairly straightfoward. Either modify the existing policy to enable loopback mode processing (computer configuration/Admin Templates/System/GroupPolicy/Loopback Policy - enable the setting and for you, probably set it to merge) or create a new policy with this setting and have the new policy applied before your drive mapping policy.

[Austin ''Danger'' Powers]

Thanks. I found this video does a brilliant job of explaining Group Policy Loopback Processing to anyone using it for the first time: youtube.com/watch?v=2bZGMtOCXN0

[Austin ''Danger'' Powers]

I would love to setup another server, but it's a non-profit organization with a tight budget, and I don't think they could justify the expense... especially considering this already works very well (apart from the delayed logon). I am excited to test out GP loopback processing tonight (probably going for "merge" rather than "replace") as this looks like it could solve the last problem they have with this configuration.

[Austin ''Danger'' Powers]

So, conversely, if I have a GPO with computer policies applied to a user OU, the computer policies will not be applied either?

[Austin ''Danger'' Powers]

If you had a GPO applied to a computer OU, and simply set loopback processing to "replace" mode (but didn't actually define any user settings in that GPO so it didn't actually conflict with any user settings), would it still prevent all user settings (defined by other GPOs and applied to users logging on to this computer) from being applied?

[Rex]

If you set the policy mode to "replace", it will drop user policy settings that have been applied in a different OU with any user policy settings defined in policy objects applied in the current OU after the loopback policy is applied. Meaning, if you have a second policy object in the computer OU with user settings that is applied after the policy that enables the loopback policy in replace mode, those settings will still be applied. However, any policy settings from a user OU will not be applied.

[Austin ''Danger'' Powers]

I have just tried Group Policy loopback processing. For some reason, the policy initially wouldn't process drive mapping using the "merge" option (not sure why). Then I set the loopback processing to "replace", and drives started mapping properly when users logged in. After that, it continued to work even after I changed it back to "merge" again. I'm not sure why "merge" didn't work right away (as it should have). Does anyone have any ideas how that could have happened? Other than that, it's all working perfectly now. Thanks everyone.

[Tim Brigham]

@Austin Correct. If a policy has both elements it needs to be applied to where object type exists. The only exception is loopback processing as Rex mentions.

[Austin ''Danger'' Powers]

Good to know. Most of our GPOs so far have been applied at the domain level, so we never had to consider that before. Thanks for clarifying.